Virustotal Yara
20 CVEs affecting Virustotal Yara. Latest disclosed: 2023-08-28. Critical: 1, High: 13.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3402 | Critical | 9.1 | 2021-05-14 | An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker to either cause denia… |
CVE-2023-40857 | High | 8.8 | 2023-08-28 | Buffer Overflow vulnerability in VirusTotal yara v.4.3.2 allows a remote attacker to execute arbtirary code via the yr_execute_cod function in the exe.c compon… |
CVE-2019-19648 | High | 7.8 | 2019-12-09 | In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size. A specially crafted MachO file can… |
CVE-2018-12035 | High | 7.8 | 2018-06-15 | In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds write vulnerability in yr_execute_code in libyara/exec.c. |
CVE-2018-12034 | High | 7.8 | 2018-06-15 | In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds read vulnerability in yr_execute_code in libyara/exec.c. |
CVE-2017-9438 | High | 7.5 | 2017-06-05 | libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex stri… |
CVE-2017-9304 | High | 7.5 | 2017-05-31 | libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled… |
CVE-2017-8929 | High | 7.5 | 2017-05-14 | The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) v… |
CVE-2017-8294 | High | 7.5 | 2017-04-27 | libyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted… |
CVE-2017-5924 | High | 7.5 | 2017-04-03 | libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandl… |
CVE-2017-5923 | High | 7.5 | 2017-04-03 | libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule t… |
CVE-2016-10211 | High | 7.5 | 2017-04-03 | libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandl… |
CVE-2016-10210 | High | 7.5 | 2017-04-03 | libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted rule that is… |
CVE-2017-9465 | High | 7.1 | 2017-06-06 | The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitiv… |
CVE-2021-45429 | Medium | 5.5 | 2022-02-04 | A Buffer Overflow vulnerablity exists in VirusTotal YARA git commit: 605b2edf07ed8eb9a2c61ba22eb2e7c362f47ba7 via yr_set_configuration in yara/libyara/libyara… |
CVE-2019-5020 | Medium | 5.5 | 2019-07-31 | An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can cause a negative va… |
CVE-2018-19976 | Medium | 5.5 | 2018-12-17 | In YARA 3.8.1, bytecode in a specially crafted compiled rule is exposed to information about its environment, in libyara/exec.c. This is a consequence of the d… |
CVE-2018-19975 | Medium | 5.5 | 2018-12-17 | In YARA 3.8.1, bytecode in a specially crafted compiled rule can read data from any arbitrary address in memory, in libyara/exec.c. Specifically, OP_COUNT can… |
CVE-2018-19974 | Medium | 5.5 | 2018-12-17 | In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. This can allow attackers to… |
CVE-2017-11328 | Medium | 5.5 | 2017-07-17 | Heap buffer overflow in the yr_object_array_set_item() function in object.c in YARA 3.x allows a denial-of-service attack by scanning a crafted .NET file. |